git.iko.soy/typeable/oauth2-proxy
on master help sign in
Panic with GitLab project repository auth (#1113)
73d9f38Piers Harding
providers/gitlab.go+6−1
compare with master
unifiedsplit
@@ -329,9 +329,14 @@ func (p *GitLabProvider) addProjectsToSession(ctx context.Context, s *sessions.S
329 if perms == nil {
329 if perms == nil {
330 // use group project access as fallback
330 // use group project access as fallback
331 perms = projectInfo.Permissions.GroupAccess
331 perms = projectInfo.Permissions.GroupAccess
332+ // group project access is not set for this user then we give up
333+ if perms == nil {
334+ logger.Errorf("Warning: user %q has no project level access to %s", s.Email, project.Name)
335+ continue
336+ }
332 }
337 }
333
338
334− if perms.AccessLevel >= project.AccessLevel {
339+ if perms != nil && perms.AccessLevel >= project.AccessLevel {
335 s.Groups = append(s.Groups, fmt.Sprintf("project:%s", project.Name))
340 s.Groups = append(s.Groups, fmt.Sprintf("project:%s", project.Name))
336 } else {
341 } else {
337 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
342 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
providers/gitlab_test.go+24
@@ -41,6 +41,7 @@ func testGitLabBackend() *httptest.Server {
41 "groups": ["foo", "bar"]
41 "groups": ["foo", "bar"]
42 }
42 }
43 `
43 `
44+
44 projectInfo := `
45 projectInfo := `
45 {
46 {
46 "name": "MyProject",
47 "name": "MyProject",
@@ -56,6 +57,18 @@ func testGitLabBackend() *httptest.Server {
56 }
57 }
57 `
58 `
58
59
60+ noAccessProjectInfo := `
61+ {
62+ "name": "NoAccessProject",
63+ "archived": false,
64+ "path_with_namespace": "no_access_group/no_access_project",
65+ "permissions": {
66+ "project_access": null,
67+ "group_access": null,
68+ }
69+ }
70+ `
71+
59 personalProjectInfo := `
72 personalProjectInfo := `
60 {
73 {
61 "name": "MyPersonalProject",
74 "name": "MyPersonalProject",
@@ -105,6 +118,13 @@ func testGitLabBackend() *httptest.Server {
105 } else {
118 } else {
106 w.WriteHeader(401)
119 w.WriteHeader(401)
107 }
120 }
121+ case "/api/v4/projects/no_access_group/no_access_project":
122+ if r.Header["Authorization"][0] == authHeader {
123+ w.WriteHeader(200)
124+ w.Write([]byte(noAccessProjectInfo))
125+ } else {
126+ w.WriteHeader(401)
127+ }
108 case "/api/v4/projects/my_group/my_archived_project":
128 case "/api/v4/projects/my_group/my_archived_project":
109 if r.Header["Authorization"][0] == authHeader {
129 if r.Header["Authorization"][0] == authHeader {
110 w.WriteHeader(200)
130 w.WriteHeader(200)
@@ -219,6 +239,10 @@ var _ = Describe("Gitlab Provider Tests", func() {
219 expectedValue: nil,
239 expectedValue: nil,
220 projects: []string{"my_group/my_project=40"},
240 projects: []string{"my_group/my_project=40"},
221 }),
241 }),
242+ Entry("project membership invalid on group project, no access at all", entitiesTableInput{
243+ expectedValue: nil,
244+ projects: []string{"no_access_group/no_access_project=30"},
245+ }),
222 Entry("project membership valid on personnal project", entitiesTableInput{
246 Entry("project membership valid on personnal project", entitiesTableInput{
223 expectedValue: []string{"project:my_profile/my_personal_project"},
247 expectedValue: []string{"project:my_profile/my_personal_project"},
224 projects: []string{"my_profile/my_personal_project"},
248 projects: []string{"my_profile/my_personal_project"},